REMARKS 

Claims 1-41 are pending in the present application. Claims 2, 17, and 30 were 
canceled; claims 1, 5-6, 8-9, 13-16, 20-21, 23-24, 28-29, 33-34, 36-37, and 41 were 
amended. Reconsideration of the claims is respectfully requested. 

Amendments were made to the specification as requested by the examiner to 
correct errors and to clarify the specification. No new matter has been added by any of 
the amendments to the specification. 

Also, applicant has submitted a replacement sheet for Figure 4A as suggested by 
the examiner. 

I. Claim Objections, Claims 2, 9, 17, 24, 30, and 37 

The examiner has objected to claims 2, 9, 17, 24, 30, and 37 because of the 
following informalities: 

In claims 2, 17 and 30, "within set of time segments" should be — 
within the set of time segments — 

To avoid problems of antecedent basis, in claims 9, 24, and 37, 
"time segment" should be — the time segment within the set of time 
segments — . 

Claims 9, 24, and 37 have been amended as requested by the examiner in order to 
correct the antecedent basis problems. 

As claims 2, 17, and 30, have been canceled, the objection to these claims are 
now moot. 

II. 35 U.S.C. § 112, Second Paragraph, Claims 5, 13, 20, 28, 33, and 41 

The examiner has rejected claims 5, 13, 20, 28, 33, and 41 under 35 U.S.C. § 1 12, 
second paragraph, as being indefinite for failing to particularly point out and distinctly 
claim the subject matter, which Applicant regards as the invention. 

The examiner states that as the Specification, or page 2, lines 24-25, defines 
"requests" as "hits", the limitation in claims 5, 13, 20, 28, 33, and 41 is selecting from a 
group comprising redundant data types, making the claims unclear. As claims 5, 13, 20, 
28, 33, and 41 have been amended to recite "requests" rather than both "requests" and 
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"hits", applicant respectfully submits that the rejection of these claims under 35 U.S.C. § 
112, second paragraph has been overcome. 

III. 35 U.S.C. § 102, Anticipation, Claims 1, 3, 5, 7, 14, 16, 18, 20, 22, 29, 31, 33, 
and 35 

Claims 1, 3, 5, 7, 14, 16, 18, 20, 22, 29, 31, 33 and 35 are rejected under 35 
U.S.C. 102(b) as being anticipated by U.S. Patent No. 5, 892,917 to Myerson. This 
rejection is respectfully traversed. 

With regard to claims 1, 3, 5, 7, 14, 16, 18, 20, 22, 29, 31, 33 and 35, the 

examiner states: 

Myerson discloses a method in a data processing system for 
maintaining data integrity in logs, the method comprising reviewing a log, 
such as a web-log including request data (column 1, lines 49-52 and 
column 5, lines 23-54), determining whether the log contains a data loss 
(column 3, lines 13-17), and adding data from a prior log to replace the 
data loss in the log (column 3, lines 17-20) to increase the integrity of the 
log if a determination is made that a data loss has occurred (column 2, 
lines 27-42). 

Myerson discloses that the log includes a sequence/set of time 
segments (column 2, lines 60-62) calculating a data integrity level for the 
log and comparing the integrity level to a threshold in order to determine 
if an acceptable level of integrity has been reached (column 8, lines 47- 
58). 

Myerson also discloses that the method is implemented as a 
computer program product of corresponding instructions (column 4, line 
40), in a system comprising a memory containing the instructions (column 
4, lines 18-19), a processing unit for executing the instructions (column 4, 
lines 16-17), a communications unit (column 4, line 19), and a user 
interface (column 4, line 19), all connected to a bus (Figure 1). 

(Office Action dated June 16, 2004, page 4). 

A prior art reference anticipates the claimed invention under 35 U.S.C. §102 only 
if every element of a claimed invention is identically shown in that single reference, 
arranged as they are in the claims. In re Bond, 910 F.2d 831, 832, 15 U.S.P.Q.2d 1566, 
1567 (Fed. Cir. 1990). The Myerson reference cited by the examiner does not anticipate 
the present invention as recited in amended claim 1, because Myerson fails to teach each 
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and every element of the claim. Amended independent claim 1, which is representative of 
amended independent claims 14, 16, and 29, reads as follows: 

1 . A method in a data processing system for maintaining data 
integrity in logs, the method comprising: 

reviewing a log, wherein the log includes a set of time segments, 
and wherein the set of time segments include at least one time segment 
defined by a user; 

determining whether the log contains a data loss, wherein the 
determining step includes analyzing each time segment within the set of 
time segments to determine whether a time segment gap tolerance has 
been exceeded; and 

adding data to replace the data loss in the log to increase integrity 
of the log if a determination is made that a data loss has occurred. 

Amended claim 1 of the present invention recites the feature of reviewing a log, 

wherein the log includes a set of time segments, and wherein the set of time segments 

include at least one time segment defined by a user. The examiner states that column 2, 

lines 60-65 of Myerson teach a log having a sequence/set of time segments, as shown in the 

passage cited below: 

The log file contains a sequence of log records, each log record representing 
an object request by a client computer. Each log record includes data 
identifying the requested object as well as some data, such as an Internet 
address, associated with the client computer or a gateway through which the 
client computer requested the object. 

{Myerson, col. 2, lines 60-65). Although Myerson teaches a log file (col. 2, lines 60-62), 
Myerson does not teach a set of time segments in the log file which include at least one 
time segment defined by a user. In fact, Myerson makes no mention of having a user- 
defined time segment in the log file. Instead, Myerson teaches analyzing a Web site log 
file and generating an expanded log file that compensates for information caching and 
gateway based Web site access. The log file used to create the expanded log file contain 
information representing the Internet address and Authenticated User name of the 
requester, an Ident name, a timestamp, the request, a response code, and a response size 
(col. 5, lines 23-55), as shown in Figure 3 of Myerson below: 
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FIGURE 3 



The expanded log file in Myerson is shown to include information from the initial log file 
as well as other addition fields added by the log expander procedure, as shown in Figure 
4 of Myerson below: 
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FIGURE 4 





As can be seen in the Figures above, Myerson does not teach having a user-defined time 
segment in the log file. Myerson merely teaches having timestamp information within 
the files. This time stamp information specifies the starting time of the communication 
between the client computer and the Web site {Myerson, col. 5, lines 43-45). This 
timestamp information is neither a time segment, nor is it user-defined. 
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In contrast, claim 1 of the present invention recites having a time segment in a log 
defined by a user. For example, Figure 4 A of the present invention illustrates an example 
of how a user may define a time segment in a log with the present invention: 
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As shown in 438-444 of this illustrative example, the user may define a time segment, 
such as a period of selected hours in the day. By allowing a user to define time segments, 
the user is given the ability to let the software determine how to define when data loss is 
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likely present, as well as allow the user to customize or affect that determination. Thus, 
while claim 1 of the present invention allow for user-defined time segments in a log file, 
Myerson merely teaches automated timestamp data indicating the start of a client session. 
Therefore, Myerson fails to teach the feature of a set of time segments in the log file 
which include at least one time segment defined by a user, as recited in claim 1 of the 
present invention. 

Furthermore, claim 1 of the present invention recites the feature of determining 
whether the log contains a data loss, wherein the determining step includes analyzing 
each time segment within the set of time segments to determine whether a time segment 
gap tolerance has been exceeded. The examiner states that Myerson teaches a 
determination whether a log contains a data loss in column 3, line 13-17, as recited in the 
passage below: 

The log expansion procedure furthermore assigns session identifiers to 
each log record so as to group the sequence of log records into pseudo- 
client sessions. It then detects when log records are missing from the 
pseudo-client sessions and supplements the sequence of log records with 
log records representing additional object requests so as to create pseudo- 
client sessions each having a logical sequence of object requests. 

{Myerson, col. 3, lines 13-20). The examiner further states in the Office Action that 

"Myerson does teach analyze frequency (i.e. time) differences in the current web-log to 

determine if data should be appended" in column 8, line 66 to column 9, line 7, as recited 

in the passage below: 

In other words, In one preferred embodiment, if the frequency of requests 
for the most popular objects is at least 15% lower than the frequency of 
requests found in the reference request profile, then the threshold amount 
of object caching for performing additional log entry insertion has been 
detected. As will be understood by those of ordinary skill in the art, 
numerous slightly different procedures can be used to compare the current 
and reference request profiles for the purpose of detecting high rates of 
object caching. 

{Myerson, col. 8, line 66 to col. 9, line 7). As can be seen, neither passage mentions 
anything about analyzing time segments present in a log to determine whether a time 
segment gap tolerance has been exceeded, nor do the passages mention that the time 
segment analyzed is defined by the user. Thus, Myerson fails to teach the feature of 
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analyzing each time segment within the set of time segments to determine whether a time 
segment gap tolerance has been exceeded, as recited in claim 1 of the present invention. 

Claims 3-7, 18-22, and 31-35 are dependent claims depending on independent 
claims 1,14, and 29, respectively. These dependent claims are patentable over Myerson 
for the same reasons as the independent claims and contain additional features not shown 
or suggested in this cited reference. For example, claims 6, 21, and 34 teach having the 
analyzing step include considering data in at least one time segment adjacent to a time 
segment being analyzed. As Myerson does not teach a time segment in a log file as in the 
presently claimed invention, Myerson fails to teach considering data in a time segment 
adjacent to a time segment being analyzed. 

Therefore, the rejection of claims 1, 3, 5, 7, 14, 16, 18, 20, 22, 29, 31, 33, and 35 
under 35 U.S. C. § 102 has been overcome. 

IV. 35 U.S.C. $ 102, Anticipation, Claims 8, 11, 13, 23, 26, 28, 36, 39, and 41 

Claims 8, 1 1, 13, 23, 26, 28, 36, 39, and 41 are rejected under 35 U.S.C. 102(b) as 
being anticipated by U.S. Patent No. 5, 931,912 to Wu et ah This rejection is respectfully 
traversed. 

With regard to claims 8, 11,13, 23, 26, 28, 36, 39, and 41, the examiner states: 

Wu discloses a method in a data processing system for analyzing a 
log, the method comprising analyzing a set of time segments in the log to 
determine whether a tolerance of a time gap, considered with respect to an 
adjacent segment (column 7, lines 36-39), has been exceeded for a time 
segment within the set of time segments (column 9, lines 57-65) and 
responsive to a determination that the time gap tolerance has been 
exceeded for the time segment within the set of time segments, generating 
an alert in the form of a flag used by a program to process the log (column 
9, line 65 to column 10, line 9). 

Wu discloses that the log includes a web log containing request 
date (column 5, lines 25-30) and that the method is implemented as a 
computer program product of corresponding instructions (column 5, lines 
40-44). 

(Office Action dated June 16, 2004, page 5). 

The Wu reference cited by the examiner does not anticipate the present invention as 
recited in amended claim 8, because Wu fails to teach each and every element of the claim. 
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Amended independent claim 8, which is representative of amended independent claims 

15, 23, and 36, reads as follows: 

8. A method in a data processing system for analyzing a log, the 
method comprising: 

analyzing a set of time segments in the log to determine whether a 
time gap tolerance has been exceeded for a time segment within the set of 
time segments, wherein the set of time segments include at least one time 
segment defined by a user; and 

responsive to a determination that the time gap tolerance has been 
exceeded for the time segment within the set of time segments, generating 
an alert. 

Claim 8 recites the feature of analyzing a set of time segments in the log to 
determine whether a time gap tolerance has been exceeded for a time segment within the 
set of time segments, wherein the set of time segments include at least one time segment 
defined by a user. The examiner cites the following sections of Wu as teaching this 
analyzing feature: 

The time gap represents the difference between the time stamp of the 
current log and that of the access pair in the tail of an active session. 

(Wu, col. 7, lines 36-39]. 

FIG. 8 shows an example of a method for finding an active candidate 
session to append the current log entry and marking all the sessions which 
are considered dormant and should be closed (step 309). As depicted, in 
step 801, the first active session is selected from the head of the list of 
active sessions. The process ends, in step 804, when all active sessions 
have been processed. In step 805, If the time gap is greater than a pre- 
specified time, TIME.sub.- FOR.sub.-- CLOSE, for closing a session, 
then the dormant 402 flag in the session header 400 is set to a true value, 
in step 806. 

(Wu, col. 9, lines 57-66]. 

The passages above teach a time gap, which represents the difference between the 
timestamp of the current log and the timestamp of the access pair in the tail of an active 
session. The passages also teach finding an active session to append the current log entry 
and marking session considered dormant. However, neither passage above teaches 
analyzing a set of time segments in the log to determine whether a time gap tolerance has 
been exceeded for a time segment within the set of time segments, wherein the set of time 
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segments include at least one time segment defined by a user. Claim 8 teaches analyzing 
a time segment in a log, wherein the time segment is defined by a user, as explained in 
the response to the rejection of claim 1 above. As the example in Figure 4A illustrates, a 
time segment is a period of time, such as a period hours in the day. These time segments 
in the log may be defined by the user. 

In contrast, Wu teaches calculating a time gap, wherein the time gap is the 
difference between the time stamp of the current log entry and the time stamp of the 
access pair at the tail end of the session. Thus, Wu teaches analyzing a difference 
between two timestamps for log entries, rather than analyzing a time segment defined by 
a user. Thus, while claim 1 of the present invention allow for user-defined time segments 
in a log file, Wu merely teaches automated timestamp data for a log entry and access 
objects for a session. Therefore, Wu fails to teach the feature of a set of time segments in 
the log file which include at least one time segment defined by a user, as recited in claim 
8 of the present invention. 

Claims 9-13, 24-28, and 37-41 are dependent claims depending on independent 
claims 8, 23, and 36, respectively. These dependent claims are patentable over Wu for the 
same reasons as the independent claims 8, 23, and 36, at least by virtue of depending from 
an allowable claim. 

Therefore, the rejection of claims 8, 1 1, 13, 23, 26, 28, 36, 39, and 41 under 35 
U.S.C. § 102 has been overcome. 

V. 35 U.S.C. 8 103. Obviousness, Claims 1-3. 5-9. 11-18, 20-24, 26-31, 33-37, and 
39-41 

Claims 1-3, 5-9, 11-18, 20-24, 26-31, 33-37, and 39-41 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Myerson in view of Wu. This rejection is 
respectfully traversed. 

With regard to claims 1-3, 5-9, 11-18, 20-24, 26-31, 33-37, and 39-41, the 
examiner states: 

As noted above, the invention of Myerson teaches many features 
of the claimed invention, and while Myerson does teach analyze frequency 
(i.e. time) differences in the current web-log to determine if data should 
be appended (column 8, lines 66 to column 9, line 7), Myerson does not 
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specifically disclose flagging the determination of an excessive time gap 
for log analysis. 

We teaches a method in a data processing system for analyzing a 
log, the method comprising analyzing a set of time segments in the log to 
determine whether a tolerance of a time gap, considered with respect to an 
adjacent segment (column 7, lines 36-39), has been exceeded for a time 
segment within the set of time segments (column 9, lines 57-65) and 
responsive to a determination that the time gap tolerance has been 
exceeded for the time segment within the set of time segments, generating 
al alert in the form of a flag used by a program to process the log (column 
9, line 65 to column 10,1 line 9). 

Wu teaches that the log includes a web log containing request data 
(column 5, lines 25-30) and that the method is implemented as a computer 
program product of corresponding instructions (column 5, lines 40-44). 

It would have been obvious to one having ordinary skill in the art 
to modify the invention of Myerson to include specifically flagging the 
determination of an excessive time gap for log analysis, as taught by Wu, 
because Myerson teaches a web-log method for use with hypertext 
systems (Myerson; column 1, lines 31-34) and Wu teaches a method 
similar to Myerson for determining when web-log data is missing and 
performing a corresponding appending routine (Wu; column 7, lines 42- 
49) due to caching of data (Wu; column 3, lines 45-52) in a hypertext 
system (Wu; column 2, lines 54-57) and suggests that the combination 
would have provided a corresponding method for adding data by selecting 
a proper active session and valid traversal path to append the current log 
entry using time-gap data (Wu; abstract and column 7, lines 50-52) 
thereby increasing the reliability of the resulting log data. 

(Office Action dated June 16, 2004, page 5). 

For an invention to be prima facie obvious, the prior art must teach or suggest all 
claim limitations. In re Royka, 490 F.2d 981, 180 USPQ 580 (CCPA 1974). The 
combination of Myerson and Wu fail to teach or suggest the present invention as recited 
in claims 1-3, 5-9, 1 1-18, 20-24, 26-31, 33-37, and 39-41. The Myerson and Wu 
references still do not teach or suggest all the claim limitations in independent claims 1, 
8, 14, 15, 16, 23, 29, and 36, as explained in the responses above to the rejection of 
independent claims 1, 14, 16, and 29 with regard to the Myerson reference, and the 
rejection of independent claims 8, 15, 23, and 36 with regard to the Wu reference. Claims 
1-3, 5-9, 11-18, 20-24, 26-31, 33-37, and 39-41 are patentable over the cited references 
because the combination of the Wu reference with Myerson would not reach the presently 
claimed invention. The features relied upon as being taught in the both the Myerson and 
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Wu references are not taught or suggested by those references, as explained above. As a 

result, a combination of these references would not reach the claimed invention in claims 

1-3, 5-9, 11-18, 20-24, 26-31, 33-37, and 39-41. 

In addition, one of ordinary skill in the art would not combine Wu with Myerson 

when each reference is considered as a whole. In considering the references as a whole, 

one of ordinary skill in the art would take into account the problems recognized and 

solved. For example, Myerson teaches: 

A system and method for analyzing a Web site log file and generating an 
expanded log file that compensates for information caching and gateway 
based Web site access. More particularly, the log file expansion procedure 
of the present invention works with a log file stored in memory on the 
server computer. The log file contains a sequence of log records, each log 
record representing an object request by a client computer. Each log 
record includes data identifying the requested object as well as some data, 
such as an Internet address, associated with the client computer or a 
gateway through which the client computer requested the object. The log 
expansion procedure analyzes the sequence of log records so as to detect 
object request patterns indicating that object requests not represented by 
the log records were satisfied by cached object copies, and then 
supplements the sequence of log records with inserted log records 
representing object requests for the objects corresponding to the cached 
object copies. As a result, the supplemented sequence of log records more 
accurately represents object requests made by client computers than the 
initial sequence of log records in the log file. Usage metering and analysis 
procedures utilized the supplemented sequence of log records to generate 
analysis reports indicative of object request patterns by the client 
computers. 

{Myerson, Abstract). Myerson is directed towards adding data to log files when caching 
occurs. The Myerson reference teaches supplementing a log file to more accurately 
represent object requests made by a client than the initial sequence of log records in the 
log file (Abstract). Myerson is directed toward adding reasonable data to log files when 
certain Web content from the content server is cached elsewhere and is therefore not 
represented as being accessed in the Web content server log file(s). 

In contrast, Wu is directed towards identifying user sessions in a stateliness 
hypertext server. Information about a request is recorded, including the hyperlink source 
(i.e., the hyper-text object that refers the client to the target object) and the hyper link 
target (i.e., the hypertext object being accessed). A hyperlink access pair is formed from 
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the hyperlink source and target, which represents a step in the user traversal path on the 
hypertext objects. Hyperlink access pairs may then be mapped into hyperlink access 
groups. These hyperlink groups can be used to provide object usage statistics (col. 3, line 
55, to col. 4, line 8). Thus, Myerson is directed towards the problem of supplementing 
log files with cached data, and Wu is directed towards identifying user sessions to analyze 
usage statistics. 

Furthermore, there is no teaching or suggestion in the references as to the 
desirability of including the features from the other references. As the Examiner has 
failed to demonstrate any motivation or incentive in the prior art to combine and modify 
the references so as to achieve the claimed invention, the alleged combination can only 
be the result of impermissible hindsight reconstruction using Applicant's own disclosure 
as a guide. While Applicant understands that all examination entails some measure of 
hindsight, when the rejection is based completely on hindsight, as in the present case, to 
the exclusion of what can be gleaned from the references, then the rejection is improper 
and should be withdrawn. 

Even if Wu was properly combinable with Myerson, the result of such a 
combination would not be the invention as recited in claim 1 of the present invention. 
Rather, such an alleged combination would result in a system substantially as taught by 
Myerson in addition to the feature of identifying user sessions to analyze usage statistics. 
Even considering Wu, the cited references still fail to teach or suggest a set of time 
segments in the log file which include at least one time segment defined by a user as 
recited in claim 1. 

In view of the above, applicant submits that independent claims 1 and 8 are not 
taught or suggested by the alleged combination of Myerson and Wu. Claims 3-7, 9-13, 
18-22, 24, 28, 31-35, and 37-41 are dependent claims depending from independent claims 
1, 8, 16, 23, 29, and 36, respectively. These dependent claims are also allowable, at least 
by virtue of their dependency on an allowable claim. 

Therefore, the rejection of claims 1-3, 5-9, 11-18, 20-24, 26-31, 33-37, and 39-41 
under 35 U.S.C. § 103 has been overcome. 
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VI. 35 U.S.C. § 103, Obviousness. Claims 4, 10, 19, 25, 32, and 38 

Claims 4, 10, 19, 25, 32, and 38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Myerson in view of Wu and further in view of U.S. Patent No. 
5,778,387 to Wilkerson et al. This rejection is respectfully traversed. 

If an independent claim is nonobvious under 35 U.S.C. §103, then any claim 
depending therefrom is nonobvious. In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. 
Cir. 1988). Claims 4, 10, 19, 25, 32, and 38 are dependent claims depending upon 
independent claims 1, 8, 16, 23, 29, and 36, respectively. Applicant has already 
demonstrated claims 1, 8, 16, 23, 29, and 36 to be in condition for allowance. Applicant 
respectfully submits that claims 4, 10, 19, 25, 32, and 38 are also allowable, at least by 
virtue of their dependency on an allowable claim. 

Furthermore, claims 4, 10, 19, 25, 32, and 38 are patentable over the cited 
references because the combination of Wu and Wilkerson with Myerson would not reach 
the presently claimed invention. The features relied upon as being taught in Myerson and 
Wu are not taught or suggested by the references, as explained above. As a result, a 
combination of these references would not reach the claimed invention in claims 4, 10, 
19, 25,32, and 38. 

Therefore, the rejection of claims 4, 10, 19, 25, 32, and 38 under 35 U.S.C. § 103 
has been overcome. 
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VII. Conclusion 

It is respectfully urged that the subject application is patentable over the cited 
references and is now in condition for allowance. 

The examiner is invited to call the undersigned at the below-listed telephone 
number if in the opinion of the examiner such a telephone conference would expedite 
aid the prosecution and examination of this application. 



DATE: 




Respectfully submitted, 




Reg. No. 51,886 
Yee & Associates, P.C. 
P.O. Box 802333 
Dallas, TX 75380 
(972) 367-2001 
Attorney for Applicant 
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AMENDMENTS TO THE DRAWINGS: 

Please replace Figure 4A with the attached Figure 4A replacement sheet showing 
the selected percentage field correctly labeled "458" as is described on page 16, line 3 of 
the specification. 



Page 2 of 24 
Etgen- 09/87 1,498 



